Unbelievable that a major packaging ecosystem still has no mechanism for end-to-end signature verification!